CVE-2026-55471highCWE-611

CVE-2026-55471: high-severity vulnerability in hapifhir org.hl7.fhir.core

HAPI FHIR: XXE in XsltUtilities.saxonTransform via unhardened Saxon TransformerFactory

Published · Updated

Follow this CVE+ Monitor org.hl7.fhir.core+ Monitor ca.uhn.hapi.fhir:org.hl7.fhir.utilities

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.6%
HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utilities.XsltUtilities saxonTransform(...) overloads instantiated a bare net.sf.saxon.TransformerFactoryImpl() without ACCESS_EXTERNAL_DTD or ACCESS_EXTERNAL_STYLESHEET restrictions, allowing an attacker who controls or can tamper with transformed XML to trigger XML External Entity injection for local file disclosure and blind XXE or SSRF to arbitrary URLs reachable from the host. This issue is fixed in version 6.9.10.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Affected products
hapifhir · org.hl7.fhir.core
Related CVEs — hapifhir org.hl7.fhir.core

In the same product, most dangerous first.

CVE-2024-45294HIGH`org.hl7.fhir.core` XXE vulnerability in XSLT transformsEPSS 1.0%CVE-2024-52007HIGHXXE vulnerability in XSLT parsing in `org.hl7.fhir.core`EPSS 0.9%CVE-2026-49485HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-45367HIGHHAPI FHIR: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP EndpointEPSS 0.7%CVE-2026-55470HIGHHAPI FHIR: DSTU2 FHIRPathEngine.matches() missing RegexTimeout protection allows ReDoSEPSS 0.7%CVE-2026-81876HIGHHAPI FHIR: SHCParser DEFLATE infinite loop causes denial of serviceEPSS 0.6%